Friederich Loheide 81b3a74ae5 Let administrators link Microsoft accounts whose UPN differs from mail ... Privileged accounts are never linked through the settable mail attribute. Two new ways make that workable when UPN and e-mail differ: - "Link Microsoft account" on the profile screen: the signed-in user (nonce, same browser via the state cookie, same user at the callback) signs in with Microsoft once and binds that identity. Existing links can only be removed by an administrator; an object ID bound elsewhere is refused. - "Assigned Microsoft account (UPN)" per user, editable by administrators, used by sign-in and user sync; with an option to remove a link. Sign-in now finds accounts by bound object ID first, then by assigned UPN, then by e-mail, so linked users sign in whatever their addresses. Also: third-audit report (docs/security-audit.md section 7), README section on linking administrator accounts, translations, tests. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>		2026-09-24 03:57:45 +00:00
..
security-audit.md	Let administrators link Microsoft accounts whose UPN differs from mail	2026-09-24 03:57:45 +00:00
wordpress-org-einreichung.md	Add certificate authentication, in-app setup guides and security audit	2026-09-22 15:04:32 +00:00